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Source noise affects the security of continuous-variable quantum key distribution (CV QKD), and is difficult 
to analyze. We propose a model to characterize Gaussian source noise through introducing a neutral party (Fred) 
who induces the noise with a general unitary transformation. Without knowing Fred's exact state, we derive the 
security bounds for both reverse and direct reconciliations and show that the bound for reverse reconciliation is 
tight. 
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I. INTRODUCTION 

Continuous-variable quantum key distribution helps two re- 
mote parties (Alice and Bob) to establish a set of secret keys 
at high speed iU]. Different from discrete-variable protocols, 
in CV QKD Alice encodes information into the quadratures 
of the optical field and Bob decodes it with high-efficiency 
and high-speed homodyne detection Besides the ex- 

perimental advantages and demonstrations, the security of CV 
QKD is also studied theoretically. The coherent-state CV- 
QKD protocol with Gaussian modulation has been proved se- 
cure under the collective attack [S'-P], and the fact that the 
security bounds for collective and coherent attacks coincide 
asymptotically has been clarified using quantum De Finetti 
theorem mllOfl. However, the securit y of pra ctical CV-QKD 
system has only been noticed recently |[lll[l2ll . It has been ob- 
served that adding noise in the error-correction postprocessing 
may increase the secret key rate li 1 3il . Furthermore, Filip et 
al. noticed that the source noise in coherent state preparation 
would undermine the key rate ifTil [isll . More recently. Weed- 
brook et al. has shown that direct reconciliation CV protocols 
is more robust against this noise than reverse reconciliation 
protocols lU^. 

From a practical viewpoint, it is meaningful to consider 
the trusted Gaussian source noise which is not controlled by 
the potential eavesdropper Eve. To analyze this source-noise 
effect, it is convenient to use the entanglement-based (EB) 
scheme to evaluate CV-QKD security. Note that two require- 
ments for the EB scheme should be satisfied here. First, the 
EB scheme is kept equivalent to the practical prepare and mea- 
sure (PM) scheme 01711 . Second, in the EB scheme the opti- 
mality of Gaussian attack is guaranteed under the collective 
attack. From this viewpoint, a three-mode entangled-state 
model has been proposed in |18] as a preliminary attempt. 
However, the security bound in that paper is not tight, since in 
order to derive a calculable bound the model assumes that the 
source noise is untrusted, from which Eve is able to acquire 
extra information. Another attempt il5i] used a beam-splitter 
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model [Fig. [IJa)], analogous to the realistic detector model 
ifTlll . to characterize the source noise. 

In this paper, we propose a novel EB model to characterize 
the Gaussian source noise. In this model a neutral party Fred 
introduces Gaussian source noise through a general Gaussian 
transformation. Without knowing Fred's exact state, a secu- 
rity bound can be derived which is tighter than previous work 
flSll . We also analyze the performance of the beam-splitter 
model under situations where source noise process includes 
either signal amplification or attenuation, and make compar- 
isons with our result. 



II. MODEL DESCRIPTION 

Before the explicit description of our model, the defini- 
tion of the covariance matrix of a quantum state is briefly re- 
viewed. For an N-mode quantum state, its covariance matrix 
y is defined by 

yij^Tx[p{{h-dd,{h-dj)}l (1) 

where the operator vector is r = (x\,p\,X2,p2, ■ ■ ■ ,xm,Pn) 
and the displacement vector is di - Tr(pr,) {d 6 R^'^). i; and 
pi are the quadratures of each optical field mode. 

The EB scheme of the beam-splitter model and our model 
is illustrated in Fig. [1] In the beam-splitter model the source 
is characterized by an EPR state held by Alice. Then an ex- 
tra EPR state interacts with either mode of the original one, 
depending on whether the source noise process amplifies or 
attenuates the signal, to introduce the noise. This is shown in 
Fig. 1(a) and Fig. 1(b). 

Our model is demonstrated in Fig. 1(c) where the source 
is also characterized by an EPR state. Alice obtains the data 
by measuring one of mode A and sends the other one Bq to 
Bob as the signal. We assume that Gaussian source noise is 
introduced by Fred who implements a unitary Gaussian trans- 
formation over F() and the signal Bq. The covariance matrix 
of the Gaussian state pf ab, describing Fred- Alice-Bob system 
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FIG. 1: (a) Beam-splitter model with signal attenuation. An extra 
EPR state is presented and one mode of which is coupled with the 
signal mode to introduce the source noise. This is similar to the con- 
ventional detector model |11]. (b) Beam-splitter model with signal 
amplification. The extra EPR state intervenes through coupling the 
mode sent to Alice and parameters are adjusted so that the EB scheme 
is equivalent to the PM scheme, (c) Our model. A neutral party Fred 
is presented who implements a unitary Gaussian transformation to 
introduce the source noise to the signal. The capital letters represent 
quantum states at each position. 



variance V(6p) — V(6x) - Xa- The state sent to Bob is then 
identical to the one described in Eq. (O, indicating that source 
preparation in the real PM scheme can be properly character- 
ized using the EB scheme. As the source-noise effect goes to 
zero, the equivalence would be identical to the one described 
in CI. 

When the signal is sent through the channel, the attack of 
the potential eavesdropper Eve can be described as performing 
a unitary transformation Ube over the signal mode Bi and her 
modes. After Eve's interaction, the covariance matrix of the 
state pfab would be 

ypAB = 

' F\\ Fi2 Fi3 ' 

Fix F22 F23 F'2^ 

F31 F32 VI ^TTa{V^ - l)(T, ' 

f;^ ^tta(v^ - i)cT, t[Ta{v+xa)+x]'^) 

(4) 

where T and x ^re channel parameters and F^ indicates the 
changed coiTelation terms due to Eve's interaction. Note that 
since jfab is partly unknown but fixed, we can prove the opti- 
mality of Gaussian attack, as shown in Appendix A. In the fol- 
lowing, the lower bounds on the secret key rate of this model 
would be derived without knowing the exact state of Fred in 
both reverse and direct reconciliations. 



after the transformation is 

' Fu F\2 Fi3 Fi4 

F21 F22 F23 F24 

ypAB, = yi ^Ta{v^ - \)(T, ' 

F42 VrlcV^^cr, Ta{V+xa)1 , 

(2) 

where Y is the variance of the EPR state, Ta and xa charac- 
terize the influence of the Gaussian source noise on the signal 
mode, I is the 2x2 identity matrix, cr^ is the Pauli-z matrix, 
and each Fij represents an unknown 2x2 matrix describing 
either F or its correlations with AB\. 

With using the coherent-state protocol as an example, the 
equivalence between the EB scheme and the practical PM 
scheme is explained below. In the EB scheme Alice performs 
a heterodyne detection on her side and gets two measurement 
results Pa and Xa- Bob's state p^, would be projected into a 
Gaussian state with covariance matrix y^, and mean d^^ satis- 
fying iB 

TB, = Fa(Xa + 1)1, 

In the PM scheme Alice originally prepares the signal mode 
Bo in a coherent state with displacement vector / VT^. 
Then, the effect of the source noise can be described by 
pB^ = ^a{Pb^ + 5p) and x^, = ^a{^b^ + ^x), in which 
6p and 6x are uncorrected noise terms with zero mean and 



III. REVERSE RECONCILIATION 

In reverse reconciliation, the secret key rate is given by 

Kpp^l{a:b)-S{b:E\ (5) 

where l{a : b) is classical mutual information between Al- 
ice and Bob and S{b : E) is quantum mutual information 
between Bob and Eve. Given the above covariance matrix 
Jfab, lia : b) can be calculated from the reduced matrix jab, 
while S{b : E) can not be learned directly from jfab since 
Fij contains undetermined parameters. Fortunately, another 
Gaussian state p'p^g with determined covariance matrix y^^^ 
exists, and serves as an upper bound on the calculation of the 
quantity 5 : E). y'p^g has the form 

ypAB - 

(10 ^ 

0/0 

TA(y+XA)l ^T[Tl(V+XA)^-l]cr, ■ 

,0 ^T[Tl(V+XA)^-l]cr, T[Ta(V + Xa) + x]^ , 

(6) 

The relationship between two Gaussian states with jfab and 
y^^g is explained below. Considering the pure Gaussian state 
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with the covariance matrix 



rv. DIRECT RECONCILIATION 



Jfab^ ■ 
/ 
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T^{V+xa)1 ^|Tj(V+XA)^-l(r, 
^TliV+XA)^-l(r, Ta(V+xa)I 



(7) 



The reduced state p^^ - Tr fA(p'fj^B^) is identical to the re- 
duced state pb, = TiFAiPFABi), so p^^^_ and pfAB, are two 
different purifications of this state. According to [20], one pu- 
rification of a fixed system can be transformed into another 
through a local unitary transformation on its ancillary system. 
Hence there exists such a unitary map UfA that transforms 
Pfab, to p'fab, ■ Furthermore, after taking Eve's attack Ube 
into account and noticing that UfA and Ube commute, it can 
be proved that pfab will be transformed into p'pAB through 
Ufa- 

In the rest of the paper expressions with the prime indicate 
the terms calculated by YpAB- The following lemma then al- 
lows us to bound Eve's knowledge. 

Lemma 1. Given two Gaussian states Pfab ond p'p^B '^^^h 
covariance matrices Jfab ond YpAS ^^own in Eqs. (0) and (|6|, 
respectively, one has the equality 



S(b:E)^S'(b:E). 



(8) 



Proof. Based on jfab and y'pAB mutual information be- 
tween Bob and Eve is, respectively, given as 



S{b:E) = S{E)-S{E\b), 
S'(b:E)^S'(E)-S'{E\b), 



(9) 



where S (E) and S '(E) are the von Neumann entropy of Eve's 
state, and S(E \ b) and S'{E \ b) are Eve's entropy con- 
ditioned on Bob's measurement results. S{E) = S(F,A,B) 
and S'(E) - S'{F,A,B) can be verified from the fact that 
Eve could purify the Fred-Alice-Bob system |19]. Because 
Pfab can be changed into p'p^B through a unitary transforma- 
tion Ufa, the von Neumann entropy S(F,A,B) - S'{F,A, B), 
and thus S{E) = S'{E). On the other hand, condition- 
ing on Bob's result b, the conditional state with 'YFA\B=b 
can be transformed into the one with 'Y'FA\B=b through Ufa, 
and thus S(F,A \ b) = S'{F,A \ b). Combining an- 
other fact that S{E \ b) = S{F,A \ b) and S'{E \ b) = 
S'iF^A I b), we conclude that S{b : E) = S'{b : E). 

□ 

Lemma 1 implies that calculation with y'pAB bound 
Eve's knowledge. Note that Eq. ^ is valid for protocols 
implementing either squeezed-state or coherent-state protocol 
with Bob using homodyne or heterodyne detection. Hence our 
model provides a tight security bound for all these protocols 
in reverse reconciliation. 



Though direct reconciliation has the 3dB limit, the security 
bounds for the sqeezed-state protocol with homodyne detec- 
tion and the no-switching protocol [4] are analyzed theoreti- 
cally. In direct reconciliation, the secret key rate is given by 



Kdr ^Ka : b)-S(a : E). 



(10) 



I{a : b) can be calculated from jab, and S{a : E) can be 
bounded by the following lemma. 

Lemma 2. Given two Gaussian states Pfab ond p'p^B ^'^^ 
covariance matrices Jfab ond y'p^g, the following inequality 
can be verified 



S(a : E) < S'(a : E). 



(11) 



The proof can be seen in Appendix B. Note that the equality 
in Eq. ( fTTT i is achieved only when F is independent of E, 
which is not necessarily satisfied in practice. This means that 
in order to bound the secret key rate. Eve's knowledge about 
Alice is overestimated by using S'(a : E). Thus, the security 
bound derived here is not tight. 



V. NUMERICAL SIMULATION 

Our simulation concerns the no-switching protocol in both 
reverse and direct reconciliations. The secret key rate Kdr 
or Krr would depend on the variables V, Ta, xa, T and x 
characterizing either source or channel influences. In the sim- 
ulation the variance is set to V = 20 and channel excess 
noise e — Tx - ^ + T - 0.04 close to the practical sce- 
nario [TTi], where electronic noise in Bob's detection is simply 
treated as part of e. In addition, to analyze both signal attenu- 
ation and amplification cases the source parameters are set to 
ea - Tax A - ^ + Ta =0.1 and Ta - 0.9 or Ta - 1-1 with 
regard to each process. 

The secret key rate is calculated using our model, the un- 
trusted source noise model, and the beam-splitter model. The 
mutual information I(a : b) is calculated according to the pro- 
tocol used, whose formula can be found in \19]. S (a : E) and 
S{b : E) in our model can be bounded using the simplified 
covariance matrix j'pab- To deal with the untrusted source 
noise, Fred is assumed to be part of Eve, and thus S(a : E) 
and S(b : E) are derived from jab ifTsI] . For the beam-splitter 
model the key rate is calculated with the covariance matrix in- 
cluding the ancillary modes, which is given in Eqs. ( IClb and 
( |C3] ) in Appendix C. 



VI. DISCUSSION AND CONCLUSION 

The simulation results can be seen in Figs. |2]and[3] where 
performances of our model, the beam-splitter model, and the 
untrusted source noise model are shown under no-switching 
protocol in reverse and direct reconciliations. From Figs. |2] 
and [3] it is clearly seen that the secret key rate of our model 
(solid line) coincides with that of the beam-splitter model 
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FIG. 2: Secret key rate as a function of the transmittance of the chan- 
nel in no-switching protocol with reverse reconciliation. The solid 
line stands for our model, dashed line for the beam-splitter model, 
and dotted line for the untrusted source noise model. Data are ac- 
quired under the variance of V = 20, and channel's excess noise is 
chosen to be e = 0.04. (a) Signal attenuation with source param- 
eter Ta = 0.9 and = 0.1. (b) Signal amplification with source 
parameter = 1.1 and =0.1 



(dashed line) in reverse reconciliation, while in direct recon- 
ciliation our result is lower. In addition, the security bound 
of our model is significantly higher than the untrusted source 
noise model (dotted line) in all cases. 

In the reverse reconciliation case (as shown in Fig. |2]i the 
coincidence of our model and the beam-splitter model on the 
secret key rate means that our model provides a tight security 
bound, even by generalizing Fred's interaction. This coinci- 
dence is due to the fact that both models provide the same 
signal state, and the information leakage to Eve is estimated 
through this state. In the direct reconciliation shown in Fig. 
|3] we remark that our bound on the secret key rate can be 
further improved since the information gained by Eve is over- 
estimated in mathematical treatment. 

In conclusion, we have proposed a model to characterize 
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FIG. 3: Secret key rate as a function of the transmittance of the chan- 
nel in no-switching protocol with direct reconciliation. The solid 
line stands for our model, dashed line for the beam-splitter model, 
and dotted line for the untrusted source noise model. Data are ac- 
quired under the variance of V = 20, and channel's excess noise is 
chosen to be e = 0.04. (a) signal attenuation with source parameter 
Ta = 0.9 and €a =0.1. (b) signal amplification with source parame- 
ter Ta = 1.1 and 64 =0.1 



the general Gaussian source noise in CV QKD. The result co- 
incides with that of the beam-splitter model in reverse rec- 
onciliation protocols, proving that our generalized model can 
provide a tight bound on the secret key rate. In direct reconcil- 
iation, though the security bound is not tight, it still surpasses 
that of the untrusted source noise model in a significant way. 
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Appendix A: Optimality of Gaussian Attacli 

Here, in our model, the security analysis on the optimal- 
ity of Gaussian collective attack needs to be rechecked be- 
cause the neutral party Fred is introduced in the EB scheme. 
Given the state pfab with covariance matrix jfab, it can be 
demonstrated that the security bound is obtained by consider- 
ing Gaussian attack. The reason is listed as follows. 

In Eqs. (|5]) and ( fTOl l I{a : b) is lower bounded by Gaussian 
attack 1 8]. As for 5 (a : £) in direct reconciliation, considering 
Bob and Fred together as a larger state B*, thus S{a : E)^ 
S(E)- S(E I a) = S(A,B*) - S(B* \ a). According to 18], 
S{a : E) reaches its maximum when the quantum state pab' 
or Pfab is Gaussian, with covariance matrix Jfab- Therefore, 
Gaussian attack is optimal for direct reconciliation protocols. 
The deduction for the reverse reconciliation protocols follows 
a similar route. 

Note that, in practical PM scheme, the source noise in- 
cluding light intensity fluctuation from a laser or modulator 
is a Gaussian one, thus the analysis is limited to the situation 
where Fred performs a general Gaussian transformation. 



Appendix B: Proof of Ineq. (11) 

The mutual information between Alice and Eve is given by 

S(a : E) = S(E)-S{E \ a), 
S'ia : E) = S'(E)-S'{E \ a). 



(Bl) 



where the equation S{E) = S'(E) can be verified with simi- 
lar reason demonstrated in Sec. III. Furthermore, we use the 
relations 



S(E\a) > S(E\a,f), 
S(E\a,f) > S'(E\a,,f), 
S'(E\a,f) = S'(E\a), 



(B2) 
(B3) 
(B4) 



where S(E \ a,f) iS'(E \ a,f)) means Eve's entropy condi- 
tioned on the measurement results a (a') and / (/') of Alice 
and Fred. Here, Eq. ( IB4l i is obtained by noticing that in Eq. 
(|6|l Fred is uncorrected with the rest of the system, that is, 

S'(E\a,f) = S'(E;a,f)-S'(a,f) 

= S'(E;a) + S'(f)-[S'(a) + S'(f)] 

= S'(E\a). (B5) 

On the other hand, Eq. ( IB2b holds because of the strong sub- 
additivity of the von Neumann entropy [20.1 . Furthermore, the 
equation 



S(E\a,f)^S'(E\a,f), 



(B6) 



can be verified in the squeezed-state protocol with homodyne 
detection, while 



S(E\a,f)>S'(E\a,f), 



holds in the no-switching protocol. Because both Gaussian 
states Pfabe and p'p^g^ are pure states, one has 



S{E\aJ)^S{B\aJ), 
S'(E\a,f)^S'(B\a,f). 



(B8) 



With using Eq. ( |B8] ), Eq. ( |B6t and InEq. ( |B7| ) are explained 
below. 

(1) In the squeezed-state protocol with homodyne detec- 
tion, S{B \ a,f) = S '{B \ a,f) can be verified through proving 
y^J — y'"/, in which y^J^ iy'"J) means the covariance matrix 
of the state ps {p'g) conditioning on the measurement results a 
(a') and / (/') of the state pfa (p'fa^- ^^^^ covariance matrix 
y''g can be obtained by ||T~ 



af 

Jb 



JB - O-B-FAiXyFA^)'^'' Crl-FA^ 



where (Tb-fa, 7 fa and jb denote part of jfab 



JFAB 



JFA O- 
Cr B-FA JB 



(B9) 



(BIO) 



and X is a matrix of the form 



X = 



( \ 0^ 



1 



1 

o; 



(BID 



which stands for the homodyne detection process on the x 
quadrature. Note that the situation where the p quadrature 
is measured has been omitted as its analysis would be identi- 
cal to the X quadrature case. The unitary transformation Ufa 
corresponds in phase-space to a symplectic operation S ||19|]. 
and therefore y'p^^ — (S © WjFABiS © iBf- Combining 
Eq. 



would then be 



Vb = TB - 0-B-FAS^(XSyFAS^X) 



MPa T 

"b-af- 



(B12) 



Without loss of generality, we assume S takes a general form 



S = 



( a Q b Q c Q \ 

a' b' c' 

d e f 

d' e' f 

g h i 

g' h' /' 



and hence satisfying SX - XS . Therefore, one has 



(B13) 



(XSjAFS^Xf 



- (SXyAFXE^f 
= (S^r\XyAFX)'"'(Sr\ 



(B14) 



(B7) 



according to the characteristics of the Moore-Penrose pseu- 
doinverse of matrix |2l|]. Observing Eqs. ( |B9t , (IB 12b and 
(lBT4l l. y"/ = y'f, which means S(B \ a,f) = S'(B \ a,f). 
According to Eq. ( IB8l l. the validity of Eq. (IB6l l is proved. 
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(2) In the no-switching protocol, InEq. ( IB7I ) is verified by 
comparing the expHcit von Neumann entropy calculated from 
the two covariance matrices y'^-^ and j"/. Starting from p'p^g 
, y'"^ can be written as ifToll 



y"/ ^ j'b- o-'b-fa^Jfa + I) ^ct'b-fa 

- {r[W+;rA)+;r]- 



(B15) 



where I is the 2x2 identity matrix. On the other hand, 

af , , /c-hT'rc-I ' /c-U?" , 

Jb =yB- o-b-fa(S ) [S 7fa(S ) + 



S cr 



B-FA- 

(B16) 

For the symplectic transformation 5 a decomposition of 
the form 5 ' = PS rQ exists, which is known as the Bloch- 
Messiah reduction 1221 . Here, 5r is a squeezing operator on 
each mode 

















^ 






































































I 

















(B17) 



and P and Q stand for two passive transformations satisfying 
P^ P - I and Q - I. Without loss of generality, matrix Q 
takes a general form 



Q 



( a Q b Q c \ 

a' b' c' 

d e f 

d' e' f 

h 
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h' /' 



(B18) 



With implementing the orthogonality of the passive transfor- 
mation P, one has 



af 

Jb 







^ j'b- (r'B-FAQ^S/iS.Qy'p^Q'S/ + IT' S rQ(r's_p/ 

Ta(V^Xa)-\ + j^ 

(B19) 



where letter W represents 



W ■ 



„2.s, fl 



o2.!2 



+ 1 



e2-'3 + 1 ' 

;2 



(B20) 



.52 + 1 e2.53 + 1 ■ 



Using Q^Q = I,W takes its value within < W < \. To 
calculate its entropy, note that the von Neumann entropy of a 
Gaussian state p is given by 



(B21) 



where g{x) - {x+\) log2(ji: + 1) - xlog2(ji:) and /I,- is the sym- 
plectic eigenvalue of the covariance matrix of p. It can then 
be shown that the von Neumann entropy of y"^ increases as its 
symplectic eigenvalue increases. Furthermore, the symplectic 
eigenvalue of y"g is the square of the multiplication of its di- 
agonal entries, and the minimum of this eigenvalue is reached 
when = 5 in y"^ - y'^p ■ This yields InEq. ( |B7| i in the 
no-switching protocol. 



Appendix C: Beam-Splitter Model under Gaussian Channel 



The secret key rate of the beam-splitter model is to be cal- 
culated with signal attenuation or amplification, respectively. 
In case of attenuation {Ja < 1) the model is shown in Fig. 1(a) 
ifisll and the result is obtained by setting the parameters in Eq. 
© as 



7FCAB - 



N_ 





[TaN + (1- 



Ta)V]I 







^JT(1 - Ta)(N^ - l)cr. 



V(l - Ta)(V^ - l)cr, 
y/TTA(l - Ta)(V - N)I 



Ta)(V^ 

VI 

ylTTAiV^ - 



- ^]T(\-Ta){N ^-1)(t, 
y/T TA{l - Ta)(V - N)I 
^TTa(V^ - l)cr, 
T[TA(V+XA)+X]i 



(CI) 



where is the variance of the ancillary EPR' shown in Fig. 1(a), which is related to the source parameters through = 
TAXA/i^ - Ta). Using this specific form of yfAB, Eve's knowledge S(E) - S{E \ a) can be calculated by implementing the 
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relation 



S(E)-S(E\a) ^ S(FGAB) - S(FGB | a). 



(C2) 



In case of amplification (Ta > 1), one needs to modify the parameter setting, and change the model according to Fig. 1(b). 
Under this situation, the global covariance matrix reads 



JFCAB 



Nb 



^jTBiNl - l)cr, 
{TbNb + {\-Tb)Vb]1 
Nb)1 







Tb)(NI-1)(t, ^JTB{\ - TbWb 




^TB{l-TB){yB- 
TB{yB+XB)l 



TbKVI ■ 



^fTTB(Vl 

^T(l - TbWI - .JtT^(VI^)ct, T(Vb + 



(C3) 



where Vb - T/^(V + xa) is the modified variance of the 
EPR state, and the corresponding noise parameters are Tb - 
Ta{V^ - l)/[T^{V - 1] andxB = [TliV + xaWxa + 

1) - V]/[Ta(V — 1)], leading to a modified variance of the an- 
cillary EPR' reading Nb = TbXbK^ - Tb)- It is easy to verify 
that such replacement would lead to the same jab as in Eq. 



Tab = 



Tb(Vb +Xb)1 ^TTb{VI - l)(r, ^ 
^TTb(V, 



l)cr, TiVB+x)i 



VI yjTTAiV^ - l)o-z 

Vrr^(y2 - 1^, a(v + xa) + xA"^) 



,(C4) 



and is therefore able to describe the amplification process. In 
order to make the model physical realizable, the parameters 



also need to satisfy < 1 and;^'^ > (1 - Tb)ITb- The first 
inequality is easily recognized since now T^{V +xa)^ > TaV^ 
and Ta > 1, leading to Ta(V^ - 1) < T^iV + xa? - 1. For the 
second inequality, by substituting Ta,Xa and V into it, we can 
transform it into 



2^n/ n (TaV-1){Ta-1) , ^ 
XA + i^ - ^)Xa -2 > 0. (C5) 



Given that satisfies > {Ta - 1)/Ta when Ta > 1, it 
is easy to verify that the left hand side reaches its minimum 
when X A - (Ta - ^)/Ta, and the minimum is just 0, which 
proves the inequality. 

With the above covariance matrix Eq. iC3i . Eve's knowl- 
edge can be obtained. 
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